Secure authenticated distance measurement

ABSTRACT

The invention relates to a method for a first communication device to perform authenticated distance measurement between the first communication device and a second communication device, wherein the first and the second communication device share a common secret and the common secret is used for performing the distance measurement between the first and the second communication device. The invention also relates to a method of determining whether data stored on a first communication device are to be accessed by a second communication device. Moreover, the invention relates to a communication device for performing authenticated distance measurement to a second communication device. The invention also relates to an apparatus for playing back multimedia content comprising a communication device.

This application is a continuation of the patent application entitled“Secure Authenticated Distance Measurement”, filed on Aug. 30, 2018 andaccorded Ser. No. 16/117,019 which is a continuation of the patentapplication filed Nov. 16, 2016 and afforded Ser. No. 15/352,646 whichis a continuation of the application filed Aug. 5, 2016 and affordedSer. No. 15/229,207 which is a continuation of the application filedNov. 11, 2014 and afforded Ser. No. 14/538,493 which claims prioritypursuant to 35 USC 120, priority to and the benefit of the earlierfiling date of, that patent application entitled “Secure AuthenticatedDistance Measurement”, filed on Jan. 21, 2005 and afforded Ser. No.10/521,858 (now U.S. Pat. No. 8,886,939), which claimed priority to andthe benefit of the earlier filing date, as a National Stage Filing ofthat international patent application filed on Jun. 27, 2003 andafforded serial number PCT/IB2003/02932 (WO2004014037), which claimedpriority to and the benefit of the earlier filing date of that patentapplication filed on Jul. 26, 2002 and afforded serial number EP02078076.3, the contents of all of which are incorporated by reference,herein.

This application is further related to that patent application entitled“Secure authenticated Distance Measurement”, filed on Jul. 24, 2009 andafforded Ser. No. 12/508,917 (now U.S. Pat. No. 8,543,819), issued Sep.24, 2013), which claimed priority to and the benefit of the earlierfiling date of that patent application entitled “Secure AuthenticatedDistance Measurement, filed on Jan. 21, 2005 and afforded Ser. No.10/521,858 (now U.S. Pat. No. 8,886,939), the contents of which areincorporated by reference herein.

The invention relates to a method for a first communication device toperforming authenticated distance measurement between a firstcommunication device and a second communication device. The inventionalso relates to a method of determining whether data stored on a firstcommunication device is to be accessed by a second communication device.Moreover, the invention relates to a communication device for performingauthenticated distance measurement to a second communication device. Theinvention also relates to an apparatus for playing back multimediacontent comprising a communication device.

Digital media have become popular carriers for various types of datainformation. Computer software and audio information, for instance, arewidely available on optical compact disks (CDs) and recently also DVDhas gained in distribution share. The CD and the DVD utilize a commonstandard for the digital recording of data, software, images, and audio.Additional media, such as recordable discs, solid-state memory, and thelike, are making considerable gains in the software and datadistribution market.

The substantially superior quality of the digital format as compared tothe analog format renders the former substantially more prone tounauthorized copying and pirating, further a digital format is botheasier and faster to copy. Copying of a digital data stream, whethercompressed, uncompressed, encrypted or non-encrypted, typically does notlead to any appreciable loss of quality in the data. Digital copyingthus is essentially unlimited in terms of multi-generation copying.Analog data with its signal to noise ratio loss with every sequentialcopy, on the other hand, is naturally limited in terms ofmulti-generation and mass copying.

The advent of the recent popularity in the digital format has alsobrought about a slew of copy protection and DRM systems and methods.These systems and methods use technologies such as encryption,watermarking and right descriptions (e.g. rules for accessing andcopying data).

One way of protecting content in the form of digital data is to ensurethat content will only be transferred between devices if

the receiving device has been authenticated as being a compliant device,and

the user of the content has the right to transfer (move, copy) thatcontent to another device.

If transfer of content is allowed, this will typically be performed inan encrypted way to make sure that the content cannot be capturedillegally in a useful format.

Technology to perform device authentication and encrypted contenttransfer is available and is called a secure authenticated channel(SAC). Although it might be allowed to make copies of content over aSAC, the content industry is very bullish on content distribution overthe Internet. This results in disagreement of the content industry ontransferring content over interfaces that match well with the Internet,e.g. Ethernet.

Further, it should be possible for a user visiting his neighbor to watcha movie, which he owns, on the neighbor's big television screen.Typically, the content owner will disallow this, but it might becomeacceptable if it can be proved that a license holder of that movie (or adevice that the license holder owns) is near that television screen.

It is therefore of interest to be able to include an authenticateddistance measurement when deciding whether content should be accessed orcopied by other devices.

In the article by Stefan Brands and David Chaum, “Distance-Boundingprotocols”, Eurocrypt '93 (1993), Pages 344-359, integration ofdistance-bounding protocols with public-key identification schemes isdescribed. Here distance measurement is described based on timemeasurement using challenge and response bits and with the use of acommitment protocol. This does not allow authenticated device compliancytesting and is not efficient when two devices must also authenticateeach other.

It is an object of the invention to obtain a solution to the problem ofperforming a secure transfer of content within a limited distance.

This is obtained by a method for a first communication device toperforming authenticated distance measurement between the firstcommunication device and a second communication device, wherein thefirst and the second communication device share a common secret and thecommon secret is used for performing the distance measurement betweenthe first and the second communication device.

Because the common secret is being used for performing the distancemeasurement, it can be ensured that when measuring the distance from thefirst communication device to the second communication device, it is thedistance between the right devices that is being measured.

The method combines a distance measurement protocol with anauthentication protocol. This enables authenticated device compliancytesting and is efficient, because a secure channel is anyhow needed toenable secure communication between devices and a device can first betested on compliancy before a distance measurement is executed.

In a specific embodiment, the authenticated distance measurement isperformed according to the following steps,

transmitting a first signal from the first communication device to thesecond communication device at a first time t1, the second communicationdevice being adapted for receiving the first signal, generating a secondsignal by modifying the received first signal according to the commonsecret and transmitting the second signal to the first device,

receiving the second signal at a second time t2,

checking if the second signal has been modified according to the commonsecret,

determining the distance between the first and the second communicationdevice according to a time difference between t1 and t2.

When measuring a distance by measuring the time difference betweentransmitting and receiving a signal and using a secret, shared betweenthe first and the second communication device, for determining whetherthe returned signal really originated from the second communicationdevice, the distance is measured in a secure authenticated way ensuringthat the distance will not be measured to a third communication device(not knowing the secret). Using the shared secret for modifying thesignal is a simple way to perform a secure authenticated distancemeasurement.

In a specific embodiment the first signal is a spread spectrum signal.Thereby a high resolution is obtained and it is possible to cope withbad transmission conditions (e.g. wireless environments with a lot ofreflections).

In another embodiment the step of checking if the second signal has beenmodified according to the common secret is performed by the steps of,

generating a third signal by modifying the first signal according to thecommon secret,

comparing the third signal with the received second signal.

This method is an easy and simple way of performing the check, but itrequires that both the first communication device and the secondcommunication device know how the first signal is being modified usingthe common secret.

In a specific embodiment the first signal and the common secret are bitwords and the second signal comprises information being generated byperforming an XOR between the bit words. Thereby, it is a very simpleoperation that has to be performed, resulting in demand for fewresources by both the first and the second communication device whenperforming the operation.

In an embodiment the common secret has been shared before performing thedistance measurement, the sharing being performed by the steps of,

performing an authentication check from the first communication deviceon the second communication device by checking whether the secondcommunication device is compliant with a set of predefined compliancerules,

if the second communication device is compliant, sharing the commonsecret by transmitting the secret to the second communication device.

This is a secure way of performing the sharing of the secret, ensuringthat only devices being compliant with compliance rules can receive thesecret. Further, the shared secret can afterwards be used for generatinga SAC channel between the two devices. The secret could be shared usinge.g. key transport mechanisms as described in ISO 11770-3.Alternatively, a key agreement protocol could be used, which e.g. isalso described in ISO 11770-3.

In another embodiment the authentication check further compriseschecking if the identification of the second device is compliant with anexpected identification. Thereby, it is ensured that the second devicereally is the device that it should be. The identity could be obtainedby checking a certificate stored in the second device.

The invention also relates to a method of determining whether datastored on a first communication device are to be accessed by a secondcommunication device, the method comprising the step of performing adistance measurement between the first and the second communicationdevice and checking whether the measured distance is within a predefineddistance interval, wherein the distance measurement is an authenticateddistance measurement according to the above. By using the authenticateddistance measurement in connection with sharing data between devices,unauthorized distribution of content can be reduced.

In a specific embodiment the data stored on the first device is sent tothe second device if it is determined that the data stored on the firstdevice are to be accessed by the second device.

The invention also relates to a method of determining whether datastored on a first communication device are to be accessed by a secondcommunication device, the method comprising the step of performing adistance measurement between a third communication device and the secondcommunication device and checking whether the measured distance iswithin a predefined distance interval, wherein the distance measurementis an authenticated distance measurement according to the above. In thisembodiment, the distance is not measured between the first communicationdevice, on which the data are stored, and the second communicationdevice. Instead, the distance is measured between a third communicationdevice and the second communication device, where the thirdcommunication device could be personal to the owner of the content.

The invention also relates to a communication device for performingauthenticated distance measurement to a second communication device,where the communication device shares a common secret with the secondcommunication device and where the communication device comprises meansfor measuring the distance to the second device using the common secret.

In an embodiment the device comprises:

means for transmitting a first signal to a second communication deviceat a first time t1, the second communication device being adapted forreceiving the first signal, generating a second signal by modifying thereceived first signal according to the common secret and transmittingthe second signal,

means for receiving the second signal at a second time t2,

means for checking if the second signal has been modified according tothe common secret, and

means for determining the distance between the first and the secondcommunication device according to a time difference between t1 and t2.

The invention also relates to an apparatus for playing back multimediacontent comprising a communication device according to the above.

In the following preferred embodiments of the invention will bedescribed referring to the figures, wherein:

FIG. 1 illustrates authenticated distance measurement being used forcontent protection,

FIG. 2 is a flow diagram illustrating the method of performingauthenticated distance measurement,

FIG. 3 illustrates in further detail the step of performing theauthenticated distance measurement shown in FIG. 2,

FIG. 4 illustrates a communication device for performing authenticateddistance measurement.

FIG. 1 illustrates an embodiment where authenticated distancemeasurement is being used for content protection. In the center of thecircle 101 a computer 103 is placed. The computer comprises content,such as multimedia content being video or audio, stored on e.g. a harddisk, DVD or a CD. The owner of the computer owns the content andtherefore the computer is authorized to access and present themultimedia content for the user. When the user wants to make a legalcopy of the content to another device via e.g. a SAC, the distancebetween the other device and the computer 103 is measured and onlydevices within a predefined distance illustrated by the devices 105,107, 109, 111, 113 inside the circle 101 are allowed to receive thecontent. Whereas the devices 115, 117, 119 having a distance to thecomputer 101 being larger than the predefined distance are not allowedto receive the content.

In the example a device is a computer, but it could e.g. also be a DVDdrive, a CD drive or a Video, as long as the device comprises acommunication device for performing the distance measurement.

In a specific example the distance might not have to be measured betweenthe computer, on which the data are stored, and the other device, itcould also be a third device e.g. a device being personal to the ownerof the content which is within the predefined distance.

In FIG. 2 a flow diagram illustrates the general idea of performingauthenticated distance measurement between two devices, 201 and 203 eachcomprising communication devices for performing the authenticateddistance measurement. In the example the first device 201 comprisescontent which the second device 203 has requested. The authenticateddistance measurement then is as follows. In step 205 the first device201 authenticates the second device 203; this could comprise the stepsof checking whether the second device 203 is a compliant device andmight also comprise the step of checking whether the second device 203really is the device identified to the first device 201. Then in step207, the first device 201 exchanges a secret with the second device 203,which e.g. could be performed by transmitting a random generated bitword to second device 203. The secret should be shared securely, e.g.according to some key management protocol as described in e.g. ISO11770.

Then in step 209, a signal for distance measurement is transmitted tothe second device 203; the second device modifies the received signalaccording to the secret and retransmits the modified signal back to thefirst device. The first device 201 measures the round trip time betweenthe signal leaving and the signal returning and checks if the returnedsignal was modified according to the exchanged secret. The modificationof the returned signal according to some secret will most likely bedependent on the transmission system and the signal used for distancemeasurement, i.e. it will be specific for each communication system(such as 1394, Ethernet, Bluetooth, IEEE 802.11, etc.).

The signal used for the distance measurement may be a normal data bitsignal, but also special signals other than for data communication maybe used. In an embodiment spread spectrum signals are used to be able toget high resolution and to be able to cope with bad transmissionconditions (e.g. wireless environments with a lot of reflections).

In a specific example a direct sequence spread spectrum signal is usedfor distance measurement; this signal could be modified by XORing thechips (e.g. spreading code consisting of 127 chips) of the directsequence code by the bits of the secret (e.g. secret consists also of127 bits). Also, other mathematical operations as XOR could be used.

The authentication 205 and exchange of secret 207 could be performedusing the protocols described in some known ISO standards ISO 9798 andISO 11770. For example the first device 201 could authenticate thesecond device 203 according to the following communication scenario:

-   First device→Second device: R_(B)∥Text 1-   where R_(B) is a random number-   Second device→First device: CertA∥TokenAB-   Where CertA is a certificate of A

TokenAB=R _(A) ∥R _(B) ∥B∥Text3∥sS_(A)(R _(A) ∥R _(B) ∥B∥Text2)

-   R_(A) is a random number-   Indentifier B is an option-   sS_(A) is a signature set by A using private key S_(A)

If TokenAB is replaced with the token as specified in ISO 11770-3 we atthe same time can do secret key exchange. We can use this bysubstituting Text2 by:

Text2:=eP _(B)(A∥K∥Text2)∥Text3

-   Where eP_(B) is encrypted with Public key B-   A is identifier of A-   K is a secret to be exchanged

In this case the second device 203 determines the key (i.e. has keycontrol), this is also called a key transport protocol, but also a keyagreement protocol could be used. This may be undesirable in which caseit can be reversed, such that the first device determines the key. Asecret key has now been exchanged according to step 207 in FIG. 2.Again, the secret key could be exchanged by e.g. a key transportprotocol or a key agreement protocol.

After the distance has been measured in a secure authenticated way asdescribed above content, data can be sent between the first and thesecond device in step 211 in FIG. 2.

FIG. 3 illustrates in further detail the step of performing theauthenticated distance measurement. As described above the first device301 and the second device 303 have exchanged a secret; the secret isstored in the memory 305 of the first device and the memory 307 of thesecond device. In order to perform the distance measurement, a signal istransmitted to the second device via a transmitter 309. The seconddevice receives the signal via a receiver 311 and 313 modifies thesignal by using the locally stored secret. The signal is modifiedaccording to rules known by the first device 301 and transmitted back tothe first device 301 via a transmitter 315. The first device 301receives the modified signal via a receiver 317 and in 319 the receivedmodified signal is compared to a signal, which has been modifiedlocally. The local modification is performed in 321 by using the signaltransmitted to the second device in transmitter 309 and then modifyingthe signal using the locally stored secret similar to the modificationrules used by the second device. If the received modified signal and thelocally modified signal are identical, then the received signal isauthenticated and can be used for determining the distance between thefirst and the second device. If the two signals are not identical, thenthe received signal cannot be authenticated and can therefore not beused for measuring the distance as illustrated by 325. In 323 thedistance is calculated between the first and the second device; thiscould e.g. be performed by measuring the time, when the signal istransmitted by the transmitter 309 from the first device to the seconddevice and measuring when the receiver 317 receives the signal from thesecond device. The time difference between transmittal time and receivetime can then be used for determining the physical distance between thefirst device and the second device.

In FIG. 4 a communication device for performing authenticated distancemeasurement is illustrated. The device 401 comprises a receiver 403 anda transmitter 411. The device further comprises means for performing thesteps described above, which could be by executing software using amicroprocessor 413 connected to memory 415 via a communication bus 417.The communication device could then be placed inside devices such as aDVD, a computer, a CD, a CD recorder, a television and other devices foraccessing protected content.

1. A first device for controlling delivery of protected content to asecond device, the first device comprising a processor circuit, theprocessor circuit arranged to execute instructions, the instructionsarranged to: receive a certificate from the second device prior tosending a first signal, wherein the certificate is associated with thesecond device; provide the first signal to the second device when thecertificate indicates that the second device is compliant with at leastone compliance rule; receive a second signal from the second deviceafter providing the first signal, wherein the second signal is derivedfrom a secret known by the second device; and provide the protectedcontent to the second device when the first device determines that thesecond signal is derived from the secret and a time between theproviding of the first signal and the receiving of the second signal isless than a predetermined time.
 2. The first device of claim 1, whereinthe secret is securely provided to the second device by the firstdevice.
 3. The first device of claim 1, wherein determining that thesecond signal is derived from the secret comprises: modifying the firstsignal, wherein the modifying requires the secret; and determining thatthe modified first signal is identical to the second signal.
 4. Thefirst device of claim 1, wherein determining that the second signal isderived from the secret comprises: modifying the first signal; anddetermining that the modified first signal is identical to the secondsignal.
 5. The first device of claim 1, wherein the predetermined timeis based on a communication system associated with the first device. 6.The first device of claim 1, further comprising instructions arranged toprovide the secret to the second device.
 7. The first device of claim 1,wherein the second signal comprises the first signal modified by thesecret.
 8. The first device of claim 1 wherein the secret comprises arandom number.
 9. The first device of claim 1 wherein the secret isencrypted with a public key.
 10. The first device of claim 1 wherein thefirst signal comprises a random number.
 11. The first device of claim 1,wherein the second signal comprises an XOR operation of the first signalwith the secret.
 12. The first device of claim 1, further comprisinginstructions arranged to receive the secret from the second device. 13.The first device of claim 1, wherein the secret is used for generating asecure channel between the first device and the second device.
 14. Thesecond device of claim 1, wherein determining that the second signal isderived from the secret comprises: modifying the second signal, whereinthe modifying requires the secret; and determining that the modifiedsecond signal is identical to the first signal.
 15. The first device ofclaim 1, wherein determining that the second signal is derived from thesecret comprises: modifying the second signal; and determining that themodified second signal is identical to the first signal.
 16. The firstdevice of claim 1, wherein the secret is known by the first device. 17.The first device of claim 2, wherein determining that the second signalis derived from the secret comprises: modifying the first signal,wherein the modifying requires the secret; and determining that themodified first signal is identical to the second signal.
 18. The firstdevice of claim 2, wherein determining that the second signal is derivedfrom the secret comprises: modifying the first signal; and determiningthat the modified first signal is identical to the second signal. 19.The first device of claim 2, wherein the predetermined time is based ona communication system associated with the first device.
 20. The firstdevice of claim 2, further comprising instructions arranged to providethe secret to the second device.
 21. The first device of claim 2,wherein the second signal comprises the first signal modified by thesecret.
 22. The first device of claim 2, wherein the secret comprises arandom number.
 23. The first device of claim 2, wherein the secret isencrypted with a public key.
 24. The first device of claim 2, whereinthe first signal comprises a random number.
 25. The first device ofclaim 2, wherein the second signal comprises an XOR operation of thefirst signal with the secret.
 26. The first device of claim 2, whereindetermining that the second signal is derived from the secret comprises:modifying the second signal, wherein the modifying requires the secret;and determining that the modified second signal is identical to thefirst signal.
 27. The first device of claim 2, wherein determining thatthe second signal is derived from the secret comprises: modifying thesecond signal; and determining that the modified second signal isidentical to the first signal.
 28. The first device of claim 2, whereinthe secret is used for generating a secure channel between the firstdevice and the second device.
 29. A method of controlling delivery ofprotected content from a first device to a second device, the firstdevice comprising a processor circuit the processor circuit arranged toexecute instructions implementing the method, the method comprising:receiving a certificate from the second device prior to sending a firstsignal, wherein the certificate is associated with the second device;providing the first signal to the second device when the certificateindicates that the second device is compliant with at least onecompliance rule; receiving a second signal from the second device afterproviding the first signal, wherein the second signal is derived from asecret known by the second device; sending the protected content fromthe first device to the second device when the first device determinesthat the second signal is derived from the secret and a time between theproviding of the first signal and the receiving of the second signal isless than a predetermined time.
 30. The method of claim 29, wherein thesecret is securely provided to the second device by the first device.31. The method of claim 29, wherein determining that the second signalis derived from the secret comprises: modifying the first signalaccording to the secret; and determining that the modified first signalis identical to the second signal.
 32. The method of claim 29, whereindetermining that the second signal is derived from the secret comprises:modifying the first signal; and determining that the modified firstsignal is identical to the second signal.
 33. The method of claim 29,wherein the predetermined time is based on a communication systemassociated with the first device.
 34. The method of claim 29, furthercomprising providing the secret to the second device.
 35. The method ofclaim 29, wherein the second signal comprises the first signal modifiedby the secret.
 36. The method of claim 29, wherein the secret comprisesa random number.
 37. The method of claim 29, wherein the secret isencrypted with a public key.
 38. The method of claim 29, wherein thefirst signal comprises a random number.
 39. The method of claim 29,wherein the second signal comprises an XOR operation of the first signalwith the secret.
 40. The method of claim 29, further comprisinginstructions arranged to receive the secret from the second device. 41.The method of claim 29, wherein the secret is used for generating asecure channel between the first device and the second device.
 42. Themethod of claim 29, wherein determining that the second signal isderived from the secret comprises: modifying the second signal accordingto the secret; and determining that the modified second signal isidentical to the first signal.
 43. The first device of claim 3, whereindetermining that the second signal is derived from the secret comprises:modifying the first signal, wherein the modifying requires the secret;and determining that the modified first signal is identical to thesecond signal.
 44. The method of claim 30, wherein determining that thesecond signal is derived from the secret comprises: modifying the firstsignal, wherein the modifying requires the secret; and determining thatthe modified first signal is identical to the second signal.
 45. Themethod of claim 30, wherein determining that the second signal isderived from the secret comprises: modifying the first signal; anddetermining that the modified first signal is identical to the secondsignal.
 46. The method of claim 30, wherein the second signal comprisesthe first signal modified by the secret.
 47. The method of claim 30,wherein determining that the second signal is derived from the secretcomprises: modifying the second signal, wherein the modifying requiresthe secret; and determining that the modified second signal is identicalto the first signal.
 48. The method of claim 30, wherein determiningthat the second signal is derived from the secret comprises: modifyingthe second signal, wherein the modifying requires the secret; anddetermining that the modified second signal is identical to the firstsignal.
 49. The method of claim 44, wherein the second signal comprisesan XOR operation of the first signal with the secret.
 50. The method ofclaim 44, wherein the secret comprises a first random number.
 51. Themethod of claim 50, wherein the secret is used for generating a securechannel between the first device and the second device.
 52. The methodof claim 50, wherein the secret is encrypted with a public key.
 53. Themethod of claim 52, wherein the first signal comprises a second randomnumber.